<?xml version="1.0" encoding="iso-8859-1" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta http-equiv="Content-Type" content=
    "application/xhtml+xml; charset=iso-8859-1" />
    <title>
      Tripwire-2.4.3.7
    </title>
    <link rel="stylesheet" type="text/css" href="../stylesheets/lfs.css" />
    <meta name="generator" content="DocBook XSL Stylesheets V1.79.1" />
    <link rel="stylesheet" href="../stylesheets/lfs-print.css" type=
    "text/css" media="print" />
  </head>
  <body class="blfs" id="blfs-9.1">
    <div class="navheader">
      <h4>
        Beyond Linux<sup>�</sup> From Scratch <span class="phrase">(System
        V</span> Edition) - Version 9.1
      </h4>
      <h3>
        Chapter&nbsp;4.&nbsp;Security
      </h3>
      <ul>
        <li class="prev">
          <a accesskey="p" href="sudo.html" title="Sudo-1.8.31">Prev</a>
          <p>
            Sudo-1.8.31
          </p>
        </li>
        <li class="next">
          <a accesskey="n" href="volume_key.html" title=
          "volume_key-0.3.12">Next</a>
          <p>
            volume_key-0.3.12
          </p>
        </li>
        <li class="up">
          <a accesskey="u" href="security.html" title=
          "Chapter&nbsp;4.&nbsp;Security">Up</a>
        </li>
        <li class="home">
          <a accesskey="h" href="../index.html" title=
          "Beyond Linux� From Scratch     (System V Edition) - Version 9.1">Home</a>
        </li>
      </ul>
    </div>
    <div class="sect1" lang="en" xml:lang="en">
      <h1 class="sect1">
        <a id="tripwire" name="tripwire"></a>Tripwire-2.4.3.7
      </h1>
      <div class="package" lang="en" xml:lang="en">
        <h2 class="sect2">
          Introduction to Tripwire
        </h2>
        <p>
          The <span class="application">Tripwire</span> package contains
          programs used to verify the integrity of the files on a given
          system.
        </p>
        <p>
          This package is known to build and work properly using an LFS-9.1
          platform.
        </p>
        <h3>
          Package Information
        </h3>
        <div class="itemizedlist">
          <ul class="compact">
            <li class="listitem">
              <p>
                Download (HTTP): <a class="ulink" href=
                "https://github.com/Tripwire/tripwire-open-source/releases/download/2.4.3.7/tripwire-open-source-2.4.3.7.tar.gz">
                https://github.com/Tripwire/tripwire-open-source/releases/download/2.4.3.7/tripwire-open-source-2.4.3.7.tar.gz</a>
              </p>
            </li>
            <li class="listitem">
              <p>
                Download MD5 sum: a5cf1bc2f235f5d8ca458f00548db6ee
              </p>
            </li>
            <li class="listitem">
              <p>
                Download size: 980 KB
              </p>
            </li>
            <li class="listitem">
              <p>
                Estimated disk space required: 29 MB
              </p>
            </li>
            <li class="listitem">
              <p>
                Estimated build time: 1.6 SBU (scripting install)
              </p>
            </li>
          </ul>
        </div>
        <h3>
          Tripwire Dependencies
        </h3>
        <h4>
          Optional
        </h4>
        <p class="optional">
          An <a class="xref" href="../server/mail.html" title=
          "Chapter&nbsp;21.&nbsp;Mail Server Software">MTA</a>
        </p>
        <p class="usernotes">
          User Notes: <a class="ulink" href=
          "http://wiki.linuxfromscratch.org/blfs/wiki/tripwire">http://wiki.linuxfromscratch.org/blfs/wiki/tripwire</a>
        </p>
      </div>
      <div class="installation" lang="en" xml:lang="en">
        <h2 class="sect2">
          Installation of Tripwire
        </h2>
        <p>
          Compile <span class="application">Tripwire</span> by running the
          following commands:
        </p>
        <pre class="userinput">
<kbd class="command">sed -e '/^CLOBBER/s/false/true/'         \
    -e 's|TWDB="${prefix}|TWDB="/var|'   \
    -e '/TWMAN/ s|${prefix}|/usr/share|' \
    -e '/TWDOCS/s|${prefix}/doc/tripwire|/usr/share/doc/tripwire-2.4.3.7|' \
    -i installer/install.cfg                               &amp;&amp;

find . -name Makefile.am | xargs                           \
    sed -i 's/^[[:alpha:]_]*_HEADERS.*=/noinst_HEADERS =/' &amp;&amp;

sed '/dist/d' -i man/man?/Makefile.am                      &amp;&amp;
autoreconf -fi                                             &amp;&amp;

./configure --prefix=/usr --sysconfdir=/etc/tripwire       &amp;&amp;
make</kbd>
</pre>
        <div class="admon note">
          <img alt="[Note]" src="../images/note.png" />
          <h3>
            Note
          </h3>
          <p>
            The default configuration is to use a local MTA. If you don't
            have an MTA installed and have no wish to install one, modify
            <code class="filename">install/install.cfg</code> to use an SMTP
            server instead. Otherwise the install will fail.
          </p>
        </div>
        <p>
          This package does not come with a test suite.
        </p>
        <p>
          Now, as the <code class="systemitem">root</code> user:
        </p>
        <pre class="root">
<kbd class="command">make install &amp;&amp;
cp -v policy/*.txt /usr/share/doc/tripwire-2.4.3.7</kbd>
</pre>
        <div class="admon note">
          <img alt="[Note]" src="../images/note.png" />
          <h3>
            Note
          </h3>
          <p>
            During <span class="command"><strong>make
            install</strong></span>, several questions are asked, including
            passwords. If you want to make a script, you have to apply a
            <span class="application">sed</span> before running <span class=
            "command"><strong>make install</strong></span>:
          </p>
          <pre class="userinput">
<kbd class="command">sed -i -e 's@installer/install.sh@&amp; -n -s <em class=
"replaceable"><code>&lt;site-password&gt;</code></em> -l <em class=
"replaceable"><code>&lt;local-password&gt;</code></em>@' Makefile</kbd>
</pre>
          <p>
            Of course, you should do this with dummy passwords and change
            them later.
          </p>
          <p>
            Another issue when scripting is that the installer exits when the
            standard input is not a terminal. You may disable this behavior
            with the following sed:
          </p>
          <pre class="userinput">
<kbd class="command">sed '/-t 0/,+3d' -i installer/install.sh</kbd>
</pre>
        </div>
      </div>
      <div class="commands" lang="en" xml:lang="en">
        <h2 class="sect2">
          Command Explanations
        </h2>
        <p>
          <span class="command"><strong>sed ...
          installer/install.cfg</strong></span>: This command tells the
          package to install the program database and reports in <code class=
          "filename">/var/lib/tripwire</code> and sets the proper location
          for man pages and documentation.
        </p>
        <p>
          <span class="command"><strong>find ...</strong></span>,
          <span class="command"><strong>sed ...</strong></span>, and
          <span class="command"><strong>autoreconf -fi</strong></span>: The
          build system is unusable as is, and has to be modified for the
          build to succeed.
        </p>
        <p>
          <span class="command"><strong>make install</strong></span>: This
          command creates the <span class="application">Tripwire</span>
          security keys as well as installing the binaries. There are two
          keys: a site key and a local key which are stored in <code class=
          "filename">/etc/tripwire/</code>.
        </p>
        <p>
          <span class="command"><strong>cp -v policy/*.txt
          /usr/doc/tripwire-2.4.3.7</strong></span>: This command installs
          the <span class="application">tripwire</span> sample policy files
          with the other <span class="application">tripwire</span>
          documentation.i
        </p>
      </div>
      <div class="configuration" lang="en" xml:lang="en">
        <h2 class="sect2">
          Configuring Tripwire
        </h2>
        <div class="sect3" lang="en" xml:lang="en">
          <h3 class="sect3">
            <a id="tripwire-config" name="tripwire-config"></a>
          </h3>
          <h4 class="title">
            <a id="tripwire-config" name="tripwire-config"></a>Config Files
          </h4>
          <p>
            <code class="filename">/etc/tripwire/*</code>
          </p>
        </div>
        <div class="sect3" lang="en" xml:lang="en">
          <h3 class="sect3"></h3>
          <h4 class="title">
            <a id="idm45779283351568" name=
            "idm45779283351568"></a>Configuration Information
          </h4>
          <p>
            <span class="application">Tripwire</span> uses a policy file to
            determine which files are integrity checked. The default policy
            file (<code class="filename">/etc/tripwire/twpol.txt</code>) is
            for a default installation and will need to be updated for your
            system.
          </p>
          <p>
            Policy files should be tailored to each individual distribution
            and/or installation. Some example policy files can be found in
            <code class="filename">/usr/share/doc/tripwire/</code>.
          </p>
          <p>
            If desired, copy the policy file you'd like to try into
            <code class="filename">/etc/tripwire/</code> instead of using the
            default policy file, <code class="filename">twpol.txt</code>. It
            is, however, recommended that you edit your policy file. Get
            ideas from the examples above and read <code class=
            "filename">/usr/share/doc/tripwire/policyguide.txt</code> for
            additional information. <code class="filename">twpol.txt</code>
            is a good policy file for learning about <span class=
            "application">Tripwire</span> as it will note any changes to the
            file system and can even be used as an annoying way of keeping
            track of changes for uninstallation of software.
          </p>
          <p>
            After your policy file has been edited to your satisfaction you
            may begin the configuration steps (perform as the <code class=
            "systemitem">root</code>) user:
          </p>
          <pre class="root">
<kbd class=
"command">twadmin --create-polfile --site-keyfile /etc/tripwire/site.key \
    /etc/tripwire/twpol.txt &amp;&amp;
tripwire --init</kbd>
</pre>
          <p>
            Depending on your system and the contents of the policy file, the
            initialization phase above can take a relatively long time.
          </p>
        </div>
        <div class="sect3" lang="en" xml:lang="en">
          <h3 class="sect3"></h3>
          <h4 class="title">
            <a id="idm45779283339168" name="idm45779283339168"></a>Usage
            Information
          </h4>
          <p>
            <span class="application">Tripwire</span> will identify file
            changes in the critical system files specified in the policy
            file. Using <span class="application">Tripwire</span> while
            making frequent changes to these directories will flag all these
            changes. It is most useful after a system has reached a
            configuration that the user considers stable.
          </p>
          <p>
            To use <span class="application">Tripwire</span> after creating a
            policy file to run a report, use the following command:
          </p>
          <pre class="root">
<kbd class="command">tripwire --check &gt; /etc/tripwire/report.txt</kbd>
</pre>
          <p>
            View the output to check the integrity of your files. An
            automatic integrity report can be produced by using a cron
            facility to schedule the runs.
          </p>
          <p>
            Reports are stored in binary and, if desired, encrypted. View
            reports, as the <code class="systemitem">root</code> user, with:
          </p>
          <pre class="root">
<kbd class=
"command">twprint --print-report -r /var/lib/tripwire/report/<em class=
"replaceable"><code>&lt;report-name.twr&gt;</code></em></kbd>
</pre>
          <p>
            After you run an integrity check, you should examine the report
            (or email) and then modify the <span class=
            "application">Tripwire</span> database to reflect the changed
            files on your system. This is so that <span class=
            "application">Tripwire</span> will not continually notify you
            that files you intentionally changed are a security violation. To
            do this you must first <span class="command"><strong>ls -l
            /var/lib/tripwire/report/</strong></span> and note the name of
            the newest file which starts with your system name as presented
            by the command <strong class="userinput"><code>uname
            -n</code></strong> and ends in <code class=
            "filename">.twr</code>. These files were created during report
            creation and the most current one is needed to update the
            <span class="application">Tripwire</span> database of your
            system. As the <code class="systemitem">root</code> user, type in
            the following command making the appropriate report name:
          </p>
          <pre class="root">
<kbd class=
"command">tripwire --update --twrfile /var/lib/tripwire/report/<em class=
"replaceable"><code>&lt;report-name.twr&gt;</code></em></kbd>
</pre>
          <p>
            You will be placed into <span class="application">Vim</span> with
            a copy of the report in front of you. If all the changes were
            good, then just type <span class=
            "command"><strong>:wq</strong></span> and after entering your
            local key, the database will be updated. If there are files which
            you still want to be warned about, remove the 'x' before the
            filename in the report and type <span class=
            "command"><strong>:wq</strong></span>.
          </p>
        </div>
        <div class="sect3" lang="en" xml:lang="en">
          <h3 class="sect3"></h3>
          <h4 class="title">
            <a id="idm45779283318672" name="idm45779283318672"></a>Changing
            the Policy File
          </h4>
          <p>
            If you are unhappy with your policy file and would like to modify
            it or use a new one, modify the policy file and then execute the
            following commands as the <code class="systemitem">root</code>
            user:
          </p>
          <pre class="root">
<kbd class=
"command">twadmin --create-polfile /etc/tripwire/twpol.txt &amp;&amp;
tripwire --init</kbd>
</pre>
        </div>
      </div>
      <div class="content" lang="en" xml:lang="en">
        <h2 class="sect2">
          Contents
        </h2>
        <div class="segmentedlist">
          <div class="seglistitem">
            <div class="seg">
              <strong class="segtitle">Installed Programs:</strong>
              <span class="segbody">siggen, tripwire, twadmin, and
              twprint</span>
            </div>
            <div class="seg">
              <strong class="segtitle">Installed Libraries:</strong>
              <span class="segbody">None</span>
            </div>
            <div class="seg">
              <strong class="segtitle">Installed Directories:</strong>
              <span class="segbody">/etc/tripwire, /var/lib/tripwire, and
              /usr/share/doc/tripwire-2.4.3.7</span>
            </div>
          </div>
        </div>
        <div class="variablelist">
          <h3>
            Short Descriptions
          </h3>
          <table border="0" class="variablelist">
            <colgroup>
              <col align="left" valign="top" />
              <col />
            </colgroup>
            <tbody>
              <tr>
                <td>
                  <p>
                    <a id="siggen" name="siggen"></a><span class=
                    "term"><span class=
                    "command"><strong>siggen</strong></span></span>
                  </p>
                </td>
                <td>
                  <p>
                    is a signature gathering utility that displays the hash
                    function values for the specified files.
                  </p>
                </td>
              </tr>
              <tr>
                <td>
                  <p>
                    <a id="tripwire-program" name=
                    "tripwire-program"></a><span class="term"><span class=
                    "command"><strong>tripwire</strong></span></span>
                  </p>
                </td>
                <td>
                  <p>
                    is the main file integrity checking program.
                  </p>
                </td>
              </tr>
              <tr>
                <td>
                  <p>
                    <a id="twadmin" name="twadmin"></a><span class=
                    "term"><span class=
                    "command"><strong>twadmin</strong></span></span>
                  </p>
                </td>
                <td>
                  <p>
                    administrative and utility tool used to perform certain
                    administrative functions related to <span class=
                    "application">Tripwire</span> files and configuration
                    options.
                  </p>
                </td>
              </tr>
              <tr>
                <td>
                  <p>
                    <a id="twprint" name="twprint"></a><span class=
                    "term"><span class=
                    "command"><strong>twprint</strong></span></span>
                  </p>
                </td>
                <td>
                  <p>
                    prints <span class="application">Tripwire</span> database
                    and report files in clear text format.
                  </p>
                </td>
              </tr>
            </tbody>
          </table>
        </div>
      </div>
      <p class="updated">
        Last updated on 2020-02-20 12:41:28 -0800
      </p>
    </div>
    <div class="navfooter">
      <ul>
        <li class="prev">
          <a accesskey="p" href="sudo.html" title="Sudo-1.8.31">Prev</a>
          <p>
            Sudo-1.8.31
          </p>
        </li>
        <li class="next">
          <a accesskey="n" href="volume_key.html" title=
          "volume_key-0.3.12">Next</a>
          <p>
            volume_key-0.3.12
          </p>
        </li>
        <li class="up">
          <a accesskey="u" href="security.html" title=
          "Chapter&nbsp;4.&nbsp;Security">Up</a>
        </li>
        <li class="home">
          <a accesskey="h" href="../index.html" title=
          "Beyond Linux� From Scratch     (System V Edition) - Version 9.1">Home</a>
        </li>
      </ul>
    </div>
  </body>
</html>
